AWS SAA-C03 practice
Practice questions for the SAA-C03, taken from the sets of the AWS course that need no account: a few questions from each part with the answer and the reason, and a quiz on those sets.
start practising
Opens the AWS map: one tap, no sign-up.
Show a question's answer to check yours. These are practice questions in the exam's format, not the provider's own papers; the quiz runs without an account.
at a glance
- exams
- SAA-C03
- questions
- 648 questions
- flashcards
- 352 flashcards
- without an account
- all 83 sets
- parts
- 4 parts
- sample questions
- 12 sample questions
SAA-C03
83 sets · 648 questions · 352 flashcards, no account needed, in 4 parts. The page shows 12 sample questions with the answers, a few from each part.
Secure
25 sets · 182 questions · 26 flashcards
from the set IAM, roles & access control
A game studio organizes its developers into squads, each responsible for its own fleet of EC2 instances. Every instance is tagged with the squad's name, and each developer's IAM principal carries a matching team tag. The studio wants every squad limited to managing only its own tagged instances, and new squads join every quarter. Which approach meets these requirements with the LEAST operational overhead?
- A separate AWS account per squad with instances migrated into it
- An IAM permissions boundary on each developer that lists the squad's instance IDs
- Attribute-based access control with policy conditions on resource tags
- A separate customer managed policy per squad, cloned for each new squad
show the answer
answer C. Attribute-based access control with policy conditions on resource tags
ABAC compares the principal's tag with the resource's tag in a condition such as aws:ResourceTag/Team equal to aws:PrincipalTag/Team, so one policy covers every squad and onboarding a squad is a tagging exercise. Cloning a policy per squad, or enumerating instance IDs in a permissions boundary, means editing IAM every quarter — and a boundary caps permissions rather than granting them. Splitting squads into separate accounts isolates them but migrating fleets is far more work than tagging.
official docs
from the set Encryption & key management
A payment card processor stores transaction records in an Amazon RDS for PostgreSQL database. To pass an upcoming PCI DSS assessment, the company must ensure that data is encrypted while stored on disk and that every connection between the application servers and the database is encrypted in transit. How can the company meet both requirements?
- Require SSL/TLS connections and enable RDS encryption at rest with a KMS key
- Enable RDS storage encryption with a KMS key and restrict the database to the application's security group
- Set the rds.force_ssl parameter to 1 and enable automated backups
- Store the connection string in AWS Secrets Manager and place the database in a private subnet
show the answer
answer A. Require SSL/TLS connections and enable RDS encryption at rest with a KMS key
Two separate controls are required: storage encryption with a KMS key, chosen at creation or adopted by restoring an encrypted snapshot copy, covers data at rest, and rds.force_ssl with clients that verify the RDS CA covers data in transit. Storage encryption alone leaves the wire in the clear; force_ssl alone leaves the disk unencrypted, and automated backups merely inherit whatever encryption the instance has. Security groups, private subnets and a secret store decide who can reach the database, not whether the bytes are encrypted.
official docs
from the set Network & perimeter security
A telecommunications company runs its billing application on EC2 instances in private subnets with no public IP addresses. Administrators occasionally need an interactive shell on these instances for troubleshooting. The security team has banned bastion hosts, refuses to open any inbound SSH ports, and does not want to distribute or manage SSH key pairs. Which solution gives administrators the required access?
- AWS Systems Manager Session Manager
- A public IP plus an inbound SSH rule
- AWS Systems Manager Run Command
- An AWS Client VPN endpoint plus SSH keys
show the answer
answer A. AWS Systems Manager Session Manager
Session Manager brokers an interactive shell over the SSM agent's outbound connection, authorised by IAM and logged to CloudTrail, so the instances need no inbound rule, no public address, no bastion and no key pair. Run Command executes documents but never gives an interactive session. A public IP with an SSH rule, or a Client VPN plus distributed SSH keys, reintroduces exactly what the security team banned.
official docs
Resilient
28 sets · 154 questions · 17 flashcards
from the set High availability & failover
An online travel agency runs its booking application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. Occasionally a server process stays up while the application it hosts stops responding to requests, yet the Auto Scaling group never replaces the instance because the underlying hardware and operating system appear healthy. The team wants such hung instances replaced automatically. Which configuration change achieves this?
- Shorten the target group's health check interval and lower its unhealthy threshold
- An Auto Scaling lifecycle hook that runs a script to restart the application
- Set the ASG health check type to ELB so failing target health checks trigger replacement
- A CloudWatch alarm on the ALB's UnHealthyHostCount metric that pages the on-call engineer
show the answer
answer C. Set the ASG health check type to ELB so failing target health checks trigger replacement
With health check type EC2 the group reacts only to hypervisor and instance status checks, which stay green while the application is hung. Health check type ELB makes the group honour the target group's HTTP check, so a target that fails it is marked unhealthy, terminated and replaced. Tightening the health check interval or alarming on UnHealthyHostCount makes the failure visible sooner without replacing anything, and lifecycle hooks run only during launch and terminate events.
official docs
from the set Decoupling & messaging
When a file lands in S3 it must trigger asynchronous processing that scales to zero when idle. Which is the simplest event-driven design?
- An S3 Lifecycle rule that starts processing when an object is created
- An EC2 Auto Scaling group that lists the bucket every minute and processes new keys
- An S3 event notification that invokes a Lambda function directly
- A nightly AWS Batch job that processes every object added that day
show the answer
answer C. An S3 event notification that invokes a Lambda function directly
An S3 event notification invokes the Lambda function the moment the object is created; concurrency follows the event rate and costs nothing while the bucket is idle, and an SQS queue in between adds buffering and retries. An Auto Scaling group that lists the bucket pays for instances during idle hours and never reaches zero. A nightly Batch job adds up to a day of latency. S3 Lifecycle rules only transition or expire objects; they cannot invoke compute at all.
official docs
from the set Backup, DR & data durability
A media company must keep master recordings in object storage that is designed for 99.999999999% (11 nines) durability across multiple facilities by default. Which service provides this?
- Amazon EFS One Zone
- Amazon S3 object storage
- S3 One Zone-IA
- Amazon EBS with daily snapshot copies
show the answer
answer B. Amazon S3 object storage
The S3 standard classes store every object redundantly across at least three Availability Zones and are designed for 99.999999999% durability with nothing to configure. S3 One Zone-IA keeps its copies in a single AZ, so it fails the multiple-facilities requirement. An EBS volume lives in one AZ; snapshots help recovery but the volume itself is not multi-facility storage. EFS One Zone is likewise single-AZ by design.
official docs
High-Performing
30 sets · 182 questions · 17 flashcards
from the set Compute & networking
An HPC job needs the lowest possible network latency and highest packet-per-second performance between a group of instances. Which placement strategy fits?
- Spread instances across all AZs
- A spread placement group
- A partition placement group
- A cluster placement group
show the answer
answer D. A cluster placement group
A cluster placement group packs instances close together in one AZ for the lowest latency and highest throughput. Spread/partition groups prioritize fault isolation; spreading across AZs adds latency.
official docs
from the set Storage & databases
A ticketing platform's serverless backend invokes thousands of concurrent Lambda functions during on-sale events. Each invocation opens a short-lived connection to an RDS for PostgreSQL database, and sales spikes now exhaust the database's connection limit, causing errors even though CPU and memory remain low. Which solution fixes this MOST efficiently?
- Reusing the database connection in the Lambda execution context
- A larger DB instance class with a higher max_connections
- Amazon RDS Proxy to pool and reuse connections
- More read replicas behind a reader endpoint
show the answer
answer C. Amazon RDS Proxy to pool and reuse connections
RDS Proxy sits between Lambda and the database and holds a pool of established connections that thousands of short-lived invocations share, so the connection count stays bounded and failover is faster as well. A larger instance class with a higher max_connections buys a few thousand more connections at much higher cost and breaks again at the next on-sale. Read replicas add read capacity while every invocation still opens its own connection to the writer. Reusing the connection inside the execution context helps within one environment, and a burst creates hundreds of environments at once.
official docs
from the set Data ingestion & analytics
A marketing team lands about 2 TB of .csv extracts in Amazon S3 every night, and the Athena queries over them scan whole files and cost far more than budgeted. Before analysts arrive each morning, a managed job must rewrite the night's files into a columnar format, and nobody wants to operate a cluster to do it. Which service should the team use?
- Amazon Redshift Spectrum
- Amazon Data Firehose record format conversion
- AWS Glue ETL jobs writing Parquet output
- Amazon EMR with a transient Spark cluster
show the answer
answer C. AWS Glue ETL jobs writing Parquet output
A Glue job reads the nightly .csv objects and writes Parquet, a columnar format that lets Athena skip columns it does not need and scan far fewer bytes; Glue provisions the Spark capacity per run, so nothing is left running afterwards. Redshift Spectrum reads the .csv files in place and converts nothing, and it needs a Redshift warehouse behind it. Firehose record format conversion applies to JSON records passing through a delivery stream, not to files already sitting in a bucket. EMR can do the rewrite but puts a Spark cluster back under the team's care.
official docs
Cost
30 sets · 130 questions · 17 flashcards
from the set Storage optimization
A photo-sharing app generates thumbnail renditions from original images and stores them in S3. Thumbnails are regenerated on demand from originals if ever lost, are accessed only occasionally after the first month, and must still be served in milliseconds when requested. The team can tolerate losing an Availability Zone's copies. Which S3 storage class is MOST cost-effective for the thumbnails?
- S3 Glacier Deep Archive
- S3 One Zone-IA
- S3 Standard
- S3 Standard-IA
show the answer
answer B. S3 One Zone-IA
One Zone-IA stores data in a single AZ at lower cost — acceptable for easily reproducible, non-critical data. Standard/Standard-IA are multi-AZ (pricier); Glacier adds retrieval latency.
official docs
from the set Compute & databases
A backend runs short, event-driven tasks with spiky invocation and long idle periods. Which compute model minimizes cost?
- An EC2 Auto Scaling group with a minimum of two instances
- AWS Lambda, billed per request and duration
- A three-year Reserved Instance for the busiest hour
- An ECS service sized for peak
show the answer
answer B. AWS Lambda, billed per request and duration
Lambda charges only for invocations and execution time, so idle costs nothing — ideal for spiky, event-driven work. Always-on or peak-sized capacity pays for idle time.
official docs
from the set Network & governance
Finance wants to be alerted when monthly spend is forecast to exceed a threshold. Which tool fits?
- AWS Cost Explorer
- AWS CloudTrail
- AWS Budgets
- AWS Config
show the answer
answer C. AWS Budgets
AWS Budgets sets cost/usage thresholds and sends alerts (including on forecasts). Cost Explorer is for analysis/visualization, not threshold alerting.
official docs
how it works
Each part shows a few of its questions, picked in a fixed order, so the page reads the same on every visit. Show an answer to see the correct option and why.
Practising a part runs a quiz on the sets made of that part alone, up to 12 of them; practising the whole exam draws a quiz at random from up to 12 of the exam's sets, the ones that mix parts included, and every start draws again. No set of this exam needs an account. Each answer is marked on the spot and what you miss comes back. A free account keeps your progress and lets you sit the mock exam.
frequently asked questions
Are these the real SAA-C03 questions?
No. The 12 sample questions on this page, and the 648 questions behind them, are practice questions in the format of the exam, written for wspell. The exam's own papers belong to its provider; the exam's page on wspell links to the official sources.
Do I need an account to practise for the SAA-C03?
No. The quiz on the SAA-C03 runs without one (all 83 sets), and a practise link starts the course for you in the same tap. A free account keeps your progress and lets you sit the mock exam.
Exam names and trade marks on this page belong to the organisations that own and run those exams. wspell is independent and is not affiliated with or endorsed by any of them.